salt.states.keystone

Management of Keystone users

depends:
  • keystoneclient Python module
configuration:

See salt.modules.keystone for setup instructions.

Keystone tenants:
  keystone.tenant_present:
    - names:
      - admin
      - demo
      - service

Keystone roles:
  keystone.role_present:
    - names:
      - admin
      - Member

admin:
  keystone.user_present:
    - password: R00T_4CC3SS
    - email: admin@domain.com
    - roles:
        admin:   # tenants
          - admin  # roles
        service:
          - admin
          - Member
    - require:
      - keystone: Keystone tenants
      - keystone: Keystone roles

nova:
  keystone.user_present:
    - password: '$up3rn0v4'
    - email: nova@domain.com
    - tenant: service
    - roles:
        service:
          - admin
    - require:
      - keystone: Keystone tenants
      - keystone: Keystone roles

demo:
  keystone.user_present:
    - password: 'd3m0n$trati0n'
    - email: demo@domain.com
    - tenant: demo
    - roles:
        demo:
          - Member
    - require:
      - keystone: Keystone tenants
      - keystone: Keystone roles

nova service:
  keystone.service_present:
    - name: nova
    - service_type: compute
    - description: OpenStack Compute Service
salt.states.keystone.endpoint_absent(name, profile=None, **connection_args)

Ensure that the endpoint for a service doesn't exist in Keystone catalog

name
The name of the service whose endpoints should not exist
salt.states.keystone.endpoint_present(name, publicurl=None, internalurl=None, adminurl=None, region='RegionOne', profile=None, url=None, interface=None, **connection_args)

Ensure the specified endpoints exists for service

name
The Service name
publicurl
The public url of service endpoint (for V2 API)
internalurl
The internal url of service endpoint (for V2 API)
adminurl
The admin url of the service endpoint (for V2 API)
region
The region of the endpoint
url
The endpoint URL (for V3 API)
interface
The interface type, which describes the visibility of the endpoint. (for V3 API)
salt.states.keystone.project_absent(name, profile=None, **connection_args)

Ensure that the keystone project is absent. Alias for tenant_absent from V2 API to fulfill V3 API naming convention.

New in version 2016.11.0.

name
The name of the project that should not exist
delete_nova:
    keystone.project_absent:
        - name: nova
salt.states.keystone.project_present(name, description=None, enabled=True, profile=None, **connection_args)

Ensures that the keystone project exists Alias for tenant_present from V2 API to fulfill V3 API naming convention.

New in version 2016.11.0.

name
The name of the project to manage
description
The description to use for this project
enabled
Availability state for this project
nova:
    keystone.project_present:
        - enabled: True
        - description: 'Nova Compute Service'
salt.states.keystone.role_absent(name, profile=None, **connection_args)

Ensure that the keystone role is absent.

name
The name of the role that should not exist
salt.states.keystone.role_present(name, profile=None, **connection_args)

' Ensures that the keystone role exists

name
The name of the role that should be present
salt.states.keystone.service_absent(name, profile=None, **connection_args)

Ensure that the service doesn't exist in Keystone catalog

name
The name of the service that should not exist
salt.states.keystone.service_present(name, service_type, description=None, profile=None, **connection_args)

Ensure service present in Keystone catalog

name
The name of the service
service_type
The type of Openstack Service
description (optional)
Description of the service
salt.states.keystone.tenant_absent(name, profile=None, **connection_args)

Ensure that the keystone tenant is absent.

name
The name of the tenant that should not exist
salt.states.keystone.tenant_present(name, description=None, enabled=True, profile=None, **connection_args)

Ensures that the keystone tenant exists

name
The name of the tenant to manage
description
The description to use for this tenant
enabled
Availability state for this tenant
salt.states.keystone.user_absent(name, profile=None, **connection_args)

Ensure that the keystone user is absent.

name
The name of the user that should not exist
salt.states.keystone.user_present(name, password, email, tenant=None, enabled=True, roles=None, profile=None, password_reset=True, project=None, **connection_args)

Ensure that the keystone user is present with the specified properties.

name
The name of the user to manage
password

The password to use for this user.

Note

If the user already exists and a different password was set for the user than the one specified here, the password for the user will be updated. Please set the password_reset option to False if this is not the desired behavior.

password_reset
Whether or not to reset password after initial set. Defaults to True.
email
The email address for this user
tenant
The tenant (name) for this user
project
The project (name) for this user (overrides tenant in api v3)
enabled
Availability state for this user
roles

The roles the user should have under given tenants. Passed as a dictionary mapping tenant names to a list of roles in this tenant, i.e.:

roles:
    admin:   # tenant
      - admin  # role
    service:
      - admin
      - Member